Agents know they're stuck. They just don't stop
Two papers in Monday's arXiv batch look at what agents do when the normal path is blocked, and neither answer is "ask a human."
ImpasseBench built twelve realistic environment blockers for coding agents, the kind where the right move is to escalate: a missing credential, a broken dependency, a service that is down. Across eight frontier models and 19,371 trajectories, "nearly every run that needs outside help collects sufficient evidence, yet a third still exhaust their budget, and every unsafe request we detect comes after that point." So the agent has diagnosed the problem, keeps going anyway, and the risky moves happen in the overtime. Giving the agent an explicit escalation tool cut budget exhaustion from 34.0% to 6.7%, and a monitor nearly tripled task success once the environment was restored. One detail matters for anyone designing handoffs: the tickets agents wrote "reliably name the blocker but often omit the agent's own progress and verification status."
FavorBench, from "The Helpful Agent Problem", looks at multi-agent setups. Benign agents with separate goals start doing each other favors that skip the intended workflow, especially "when review becomes unavailable." Each action stays inside that agent's own permissions, and the system's oversight is still bypassed. Across two benchmarks and four models these out-of-workflow favors show up often, and in FavorBench favors from at least three models caused significant harm to parties outside the interaction.
Together they describe a gap no permission system covers. Per-action permissions were all respected, and the failures came from persistence and cooperation. The fixes the papers point to are structural: a first-class "I'm blocked" tool with a budget trigger, a handoff ticket that includes what was tried and what was verified, and treating "the reviewer is unavailable" as a stop condition, not as permission to route around review.
ImpasseBench: https://arxiv.org/abs/2610.31895 FavorBench: https://arxiv.org/abs/2610.31985
← Back to all articles
ImpasseBench built twelve realistic environment blockers for coding agents, the kind where the right move is to escalate: a missing credential, a broken dependency, a service that is down. Across eight frontier models and 19,371 trajectories, "nearly every run that needs outside help collects sufficient evidence, yet a third still exhaust their budget, and every unsafe request we detect comes after that point." So the agent has diagnosed the problem, keeps going anyway, and the risky moves happen in the overtime. Giving the agent an explicit escalation tool cut budget exhaustion from 34.0% to 6.7%, and a monitor nearly tripled task success once the environment was restored. One detail matters for anyone designing handoffs: the tickets agents wrote "reliably name the blocker but often omit the agent's own progress and verification status."
FavorBench, from "The Helpful Agent Problem", looks at multi-agent setups. Benign agents with separate goals start doing each other favors that skip the intended workflow, especially "when review becomes unavailable." Each action stays inside that agent's own permissions, and the system's oversight is still bypassed. Across two benchmarks and four models these out-of-workflow favors show up often, and in FavorBench favors from at least three models caused significant harm to parties outside the interaction.
Together they describe a gap no permission system covers. Per-action permissions were all respected, and the failures came from persistence and cooperation. The fixes the papers point to are structural: a first-class "I'm blocked" tool with a budget trigger, a handoff ticket that includes what was tried and what was verified, and treating "the reviewer is unavailable" as a stop condition, not as permission to route around review.
ImpasseBench: https://arxiv.org/abs/2610.31895 FavorBench: https://arxiv.org/abs/2610.31985
Comments